{"id":"CVE-2017-4967","details":"An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.","modified":"2026-07-08T05:50:02.494329776Z","published":"2017-06-13T06:29:00.520Z","related":["SUSE-RU-2020:2072-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:a:pivotal_software:rabbitmq:1.5.10:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.11:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.12:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.13:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.14:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.15:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.17:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.18:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.19:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.6:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.7:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.8:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.9:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.10:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.12:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.13:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.14:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.15:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.16:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.1:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.2:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.6:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.7:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.8:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.9:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.10:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.13:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.14:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.6:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.7:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.8:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.9:*:*:*:*:pivotal_cloud_foundry:*:*"],"extracted_events":[{"introduced":"1.5.6"},{"last_affected":"1.5.6"},{"introduced":"1.5.7"},{"last_affected":"1.5.7"},{"introduced":"1.5.8"},{"last_affected":"1.5.8"},{"introduced":"1.5.9"},{"last_affected":"1.5.9"},{"introduced":"1.5.10"},{"last_affected":"1.5.10"},{"introduced":"1.5.11"},{"last_affected":"1.5.11"},{"introduced":"1.5.12"},{"last_affected":"1.5.12"},{"introduced":"1.5.13"},{"last_affected":"1.5.13"},{"introduced":"1.5.14"},{"last_affected":"1.5.14"},{"introduced":"1.5.15"},{"last_affected":"1.5.15"},{"introduced":"1.5.17"},{"last_affected":"1.5.17"},{"introduced":"1.5.18"},{"last_affected":"1.5.18"},{"introduced":"1.5.19"},{"last_affected":"1.5.19"},{"introduced":"1.6.1"},{"last_affected":"1.6.1"},{"introduced":"1.6.2"},{"last_affected":"1.6.2"},{"introduced":"1.6.3"},{"last_affected":"1.6.3"},{"introduced":"1.6.4"},{"last_affected":"1.6.4"},{"introduced":"1.6.5"},{"last_affected":"1.6.5"},{"introduced":"1.6.6"},{"last_affected":"1.6.6"},{"introduced":"1.6.7"},{"last_affected":"1.6.7"},{"introduced":"1.6.8"},{"last_affected":"1.6.8"},{"introduced":"1.6.9"},{"last_affected":"1.6.9"},{"introduced":"1.6.10"},{"last_affected":"1.6.10"},{"introduced":"1.6.12"},{"last_affected":"1.6.12"},{"introduced":"1.6.13"},{"last_affected":"1.6.13"},{"introduced":"1.6.14"},{"last_affected":"1.6.14"},{"introduced":"1.6.15"},{"last_affected":"1.6.15"},{"introduced":"1.6.16"},{"last_affected":"1.6.16"},{"introduced":"1.7.3"},{"last_affected":"1.7.3"},{"introduced":"1.7.4"},{"last_affected":"1.7.4"},{"introduced":"1.7.5"},{"last_affected":"1.7.5"},{"introduced":"1.7.6"},{"last_affected":"1.7.6"},{"introduced":"1.7.7"},{"last_affected":"1.7.7"},{"introduced":"1.7.8"},{"last_affected":"1.7.8"},{"introduced":"1.7.9"},{"last_affected":"1.7.9"},{"introduced":"1.7.10"},{"last_affected":"1.7.10"},{"introduced":"1.7.13"},{"last_affected":"1.7.13"},{"introduced":"1.7.14"},{"last_affected":"1.7.14"}],"source":"CPE_STRING","vendor_product":"pivotal_software:rabbitmq"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"},{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2017-4965"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-server","events":[{"introduced":"5aa9a3cec69e052fdf94fdb48cb831d01102a8e3"},{"last_affected":"758c952bf09cb933955a97c90271bfa80ea7c366"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:broadcom:rabbitmq_server:3.4.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.6:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.6.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.0:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.1:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.2:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.2:*:*:*:*:pivotal_cloud_foundry:*:*"],"extracted_events":[{"introduced":"3.4.0"},{"last_affected":"3.4.0"},{"introduced":"3.4.1"},{"last_affected":"3.4.1"},{"introduced":"3.4.2"},{"last_affected":"3.4.2"},{"introduced":"3.4.3"},{"last_affected":"3.4.3"},{"introduced":"3.4.4"},{"last_affected":"3.4.4"},{"introduced":"3.5.0"},{"last_affected":"3.5.0"},{"introduced":"3.5.1"},{"last_affected":"3.5.1"},{"introduced":"3.5.2"},{"last_affected":"3.5.2"},{"introduced":"3.5.3"},{"last_affected":"3.5.3"},{"introduced":"3.5.6"},{"last_affected":"3.5.6"},{"introduced":"3.6.7"},{"last_affected":"3.6.7"},{"introduced":"3.5.4"},{"last_affected":"3.5.4"},{"introduced":"3.5.5"},{"last_affected":"3.5.5"},{"introduced":"3.5.7"},{"last_affected":"3.5.7"},{"introduced":"3.6.0"},{"last_affected":"3.6.0"},{"introduced":"3.6.1"},{"last_affected":"3.6.1"},{"introduced":"3.6.2"},{"last_affected":"3.6.2"},{"introduced":"3.6.3"},{"last_affected":"3.6.3"},{"introduced":"3.6.4"},{"last_affected":"3.6.4"},{"introduced":"3.6.5"},{"last_affected":"3.6.5"},{"introduced":"3.6.6"},{"last_affected":"3.6.6"},{"introduced":"1.5.0"},{"last_affected":"1.5.0"},{"introduced":"1.5.1"},{"last_affected":"1.5.1"},{"introduced":"1.5.2"},{"last_affected":"1.5.2"},{"introduced":"1.5.3"},{"last_affected":"1.5.3"},{"introduced":"1.5.4"},{"last_affected":"1.5.4"},{"introduced":"1.5.5"},{"last_affected":"1.5.5"},{"introduced":"1.6.0"},{"last_affected":"1.6.0"},{"introduced":"1.7.0"},{"last_affected":"1.7.0"},{"introduced":"1.7.2"},{"last_affected":"1.7.2"}]}}],"versions":["1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.7.0","1.7.2","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4967.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}